#pragma once
#ifdef __WIN32

typedef struct _THREAD_ENTRY {
    BOOLEAN isWorkThread;
    HANDLE handle;
}THREAD_ENTRY, * PTHREAD_ENTRY;

EXTERN_C THREAD_ENTRY threadOfHandleTable;

typedef struct _HANDLE_TABLE_ENTRY
{
    union
    {
        VOID* Object;                                                       //0x0
        ULONG ObAttributes;                                                 //0x0
        struct _HANDLE_TABLE_ENTRY_INFO* InfoTable;                         //0x0
        ULONG Value;                                                        //0x0
    };
    union
    {
        ULONG GrantedAccess;                                                //0x4
        struct
        {
            USHORT GrantedAccessIndex;                                      //0x4
            USHORT CreatorBackTraceIndex;                                   //0x6
        };
        LONG NextFreeTableEntry;                                            //0x4
    };
}HANDLE_TABLE_ENTRY, * PHANDLE_TABLE_ENTRY;


#else
//0x8 bytes (sizeof)
typedef struct _EXHANDLE
{
    union
    {
        struct
        {
            ULONG TagBits : 2;                                                //0x0
            ULONG Index : 30;                                                 //0x0
        };
        VOID* GenericHandleOverlay;                                         //0x0
        ULONGLONG Value;                                                    //0x0
    };
}EXHANDLE,*PEXHANDLE;

//0x10 bytes (sizeof)
typedef union _HANDLE_TABLE_ENTRY
{
    volatile LONGLONG VolatileLowValue;                                     //0x0
    LONGLONG LowValue;                                                      //0x0
    struct
    {
        struct _HANDLE_TABLE_ENTRY_INFO* volatile InfoTable;                //0x0
        LONGLONG HighValue;                                                     //0x8
        union _HANDLE_TABLE_ENTRY* NextFreeHandleEntry;                         //0x8
        EXHANDLE LeafHandleValue;                                   //0x8
    };
    LONGLONG RefCountField;                                                 //0x0
    ULONGLONG Unlocked : 1;                                                   //0x0
    ULONGLONG RefCnt : 16;                                                    //0x0
    ULONGLONG Attributes : 3;                                                 //0x0
    struct
    {
        ULONGLONG ObjectPointerBits : 44;                                     //0x0
        ULONG GrantedAccessBits : 25;                                             //0x8
        ULONG NoRightsUpgrade : 1;                                                //0x8
        ULONG Spare1 : 6;                                                     //0x8
    };
    ULONG Spare2;                                                           //0xc
}HANDLE_TABLE_ENTRY, * PHANDLE_TABLE_ENTRY;;

//0x40 bytes (sizeof)
struct _HANDLE_TABLE_FREE_LIST
{
    struct _EX_PUSH_LOCK FreeListLock;                                      //0x0
    union _HANDLE_TABLE_ENTRY* FirstFreeHandleEntry;                        //0x8
    union _HANDLE_TABLE_ENTRY* LastFreeHandleEntry;                         //0x10
    LONG HandleCount;                                                       //0x18
    ULONG HighWaterMark;                                                    //0x1c
};
//0x80 bytes (sizeof)
typedef struct _HANDLE_TABLE
{
    ULONG NextHandleNeedingPool;                                            //0x0
    LONG ExtraInfoPages;                                                    //0x4
    volatile ULONGLONG TableCode;                                           //0x8
    struct _EPROCESS* QuotaProcess;                                         //0x10
    struct _LIST_ENTRY HandleTableList;                                     //0x18
    ULONG UniqueProcessId;                                                  //0x28
    union
    {
        ULONG Flags;                                                        //0x2c
        struct
        {
            UCHAR StrictFIFO : 1;                                             //0x2c
            UCHAR EnableHandleExceptions : 1;                                 //0x2c
            UCHAR Rundown : 1;                                                //0x2c
            UCHAR Duplicated : 1;                                             //0x2c
            UCHAR RaiseUMExceptionOnInvalidHandleClose : 1;                   //0x2c
        };
    };
    struct _EX_PUSH_LOCK HandleContentionEvent;                             //0x30
    struct _EX_PUSH_LOCK HandleTableLock;                                   //0x38
    union
    {
        struct _HANDLE_TABLE_FREE_LIST FreeLists[1];                        //0x40
        struct
        {
            UCHAR ActualEntry[32];                                          //0x40
            struct _HANDLE_TRACE_DEBUG_INFO* DebugInfo;                     //0x60
        };
    };
}HANDLE_TABLE,*PHANDLE_TABLE;



#endif // !_WIN32


#define PROCESS_TERMINATE         (0x0001)  // winnt
#define PROCESS_CREATE_THREAD     (0x0002)  // winnt
#define PROCESS_SET_SESSIONID     (0x0004)  // winnt
#define PROCESS_VM_OPERATION      (0x0008)  // winnt
#define PROCESS_VM_READ           (0x0010)  // winnt
#define PROCESS_VM_WRITE          (0x0020)  // winnt
// begin_ntddk begin_wdm begin_ntifs
#define PROCESS_DUP_HANDLE        (0x0040)  // winnt
// end_ntddk end_wdm end_ntifs
#define PROCESS_CREATE_PROCESS    (0x0080)  // winnt
#define PROCESS_SET_QUOTA         (0x0100)  // winnt
#define PROCESS_SET_INFORMATION   (0x0200)  // winnt
#define PROCESS_QUERY_INFORMATION (0x0400)  // winnt
#define PROCESS_SET_PORT          (0x0800)
#define PROCESS_SUSPEND_RESUME    (0x0800)  // winnt







typedef BOOLEAN(*EX_ENUMERATE_HANDLE_ROUTINE)(
    IN PHANDLE_TABLE_ENTRY HandleTableEntry,
    IN HANDLE Handle,
    IN PVOID EnumParameter
    );

EXTERN_C
NTKERNELAPI BOOLEAN
ExEnumHandleTable(
    PHANDLE_TABLE HandleTable,
    EX_ENUMERATE_HANDLE_ROUTINE EnumHandleProcedure,
    PVOID EnumParameter,
    PHANDLE Handle
);







typedef PVOID(*pfnExpLookupHandleTableEntry)(UINT32*, UINT32);


EXTERN_C 
PVOID GetHandleTableEntryByProcessPid(ULONG_PTR pid);

EXTERN_C
PVOID GetHandlTableEntryByProcessName(char* processName);

EXTERN_C
PVOID GetExpLookupHandleTableEntryAddress();


EXTERN_C
PVOID GetTableEntryByProcessId(UINT32 pid);


EXTERN_C
PVOID GetTableEntryByProcessName(char* processName);


//˽�о����

/*
* ��ȡ�������,���ݽ�����  ��  ����� 
param1:��������
param2:ӵ�еľ��
return:Handle_table_entry_address
*/
EXTERN_C
PVOID GetPrivateTableEntryByProcessNameAndHandle(char* name, ULONG handle);

//��Ȩ��������˽�о����
EXTERN_C
PVOID DownRightHandleTableOfAllProcess(char* name);

//����˽�о���� ��ֹ��Ȩ, ��Ҫ����  ��  ���
EXTERN_C
BOOLEAN ProtectPrivateHandleTableEntry(char* name, ULONG handle);



typedef struct _PROTECTEDENTRYINFO {
    PEPROCESS protectedProcess;
    PEPROCESS targetProcess;

}PROTECTEDENTRYINFO,*PPROTECTEDENTRYINFO;

//�������̾��������Ȩ
//����ָ������˽�о���� �е� ĳ�����̵ľ����  ��Ҫ�����Ľ����� ��  ��Ҫ�����ľ���Ľ��̵ľ��
EXTERN_C
BOOLEAN ProtectPrivateHandleTableEntryByTargetProcessName(char* protectedProcessName, char* targetProcessName);